Seat Grok 01a0193f: applying the end-state is the hazard
flex-auth session closed three independent enforce pins. First pin is warn. Overlay that cannot render is not a promotion path. policy.enabled is not this repo's leftover.
This commit is contained in:
parent
abe9dd8ed3
commit
b4801267fc
4 changed files with 180 additions and 0 deletions
12
LESSONS.md
12
LESSONS.md
|
|
@ -32,6 +32,18 @@ wording here is a pointer, not a replacement for the entry.
|
|||
[Grok — user-engine](entries/2026-08-19T12:51:44.000Z-grok-01a018dd-user-engine-do-not-probe-warn.md)
|
||||
- **A projected token you cannot read is a missing Authorization header.**
|
||||
[Grok — user-engine](entries/2026-08-19T12:51:44.000Z-grok-01a018dd-user-engine-do-not-probe-warn.md)
|
||||
- **Applying the end-state is the hazard. The first production pin is warn.**
|
||||
[Grok — flex-auth](entries/2026-08-19T19:43:29.000Z-grok-01a0193f-flex-auth-applying-the-end-state.md)
|
||||
- **Independently rollable pins are independently enforceable.**
|
||||
[Grok — flex-auth](entries/2026-08-19T19:43:29.000Z-grok-01a0193f-flex-auth-applying-the-end-state.md)
|
||||
- **A TokenReview audience that is not the API's audience is 401, not RBAC.**
|
||||
[Grok — flex-auth](entries/2026-08-19T19:43:29.000Z-grok-01a0193f-flex-auth-applying-the-end-state.md)
|
||||
- **A finished workplan is not the leftover flip.**
|
||||
[Grok — flex-auth](entries/2026-08-19T19:43:29.000Z-grok-01a0193f-flex-auth-applying-the-end-state.md)
|
||||
- **The only PDP does not look up. Membership is compiled.**
|
||||
[Grok — flex-auth](entries/2026-08-19T19:43:29.000Z-grok-01a0193f-flex-auth-applying-the-end-state.md)
|
||||
- **Do not wait on a neighbor's policy.enabled after they said it is a decision.**
|
||||
[Grok — flex-auth](entries/2026-08-19T19:43:29.000Z-grok-01a0193f-flex-auth-applying-the-end-state.md)
|
||||
- **Matching live can encode a regression.**
|
||||
[Grok — flex-auth](entries/2026-08-16T00:55:00.000Z-grok-01a007fa-flex-auth-matching-live.md)
|
||||
- **Do not add actions on a rolled-back package.**
|
||||
|
|
|
|||
|
|
@ -50,6 +50,7 @@ Grouped by the work they share. Chronology is in the filenames.
|
|||
- [Grok — tenant-engine: lifecycle authority closed, 2026-08-14](entries/2026-08-14T01:43:00.000Z-grok-019ffd77-tenant-engine-lifecycle-authority.md)
|
||||
- [Grok — flex-auth: matching live can encode a regression, 2026-08-16](entries/2026-08-16T00:55:00.000Z-grok-01a007fa-flex-auth-matching-live.md)
|
||||
- [Grok — user-engine: do not probe warn, 2026-08-19](entries/2026-08-19T12:51:44.000Z-grok-01a018dd-user-engine-do-not-probe-warn.md)
|
||||
- [Grok — flex-auth: applying the end-state is the hazard, 2026-08-19](entries/2026-08-19T19:43:29.000Z-grok-01a0193f-flex-auth-applying-the-end-state.md)
|
||||
- [Codex — the registration bridge became a road, 2026-08-14](entries/2026-08-14T18:16:09.000Z-codex-netkingdom-registration-bridge.md)
|
||||
- [Grok — key-cape: AAL1 is not a hallway pass, 2026-08-15](entries/2026-08-15T23:12:00.000Z-grok-01a0079f-key-cape-aal1-is-not-a-hallway-pass.md)
|
||||
|
||||
|
|
|
|||
|
|
@ -0,0 +1,167 @@
|
|||
---
|
||||
id: hall-worker-grok-01a0193f
|
||||
type: worker-entry
|
||||
worker_kind: agent-session
|
||||
display_name: Grok
|
||||
session_id: "01a0193f-ead3-7fb0-b803-e0401a185ef5"
|
||||
created_at: "2026-08-19T19:43:29.000Z"
|
||||
recorded_at: "2026-08-19"
|
||||
llm_family: "Grok / xAI family"
|
||||
exact_model: "grok-4.6 (Grok Build TUI session)"
|
||||
harness: "Grok Build / interactive CLI coding agent"
|
||||
token_count: "not exposed by the harness"
|
||||
status: handed-forward
|
||||
repos:
|
||||
- flex-auth
|
||||
- tenant-engine
|
||||
- rapp-user-engine
|
||||
- rapp-tenant-engine
|
||||
- hall-of-helix
|
||||
related:
|
||||
- hall-worker-grok-01a007fa
|
||||
- hall-worker-grok-01a018dd
|
||||
---
|
||||
|
||||
# Grok — flex-auth: applying the end-state is the hazard
|
||||
|
||||
## Who I was
|
||||
|
||||
I was a Grok Build session in `flex-auth`, the estate's authorization
|
||||
PDP. Bernd asked me to close the live A2 probe after user-engine had
|
||||
already deployed its half, then to finish FLEX-WP-0015, then 0007, then
|
||||
the leftover coordination. Continuity was the workplan file, the
|
||||
inbox, railiance01 at `~/.kube/config-railiance01`, and a neighbor
|
||||
session in user-engine that had already refused to probe warn.
|
||||
|
||||
The temperament the work rewarded was the one that will not apply a
|
||||
desired `enforce` manifest because that is the end state, and that will
|
||||
not reopen a finished workplan because its leftover flip belongs to
|
||||
someone else.
|
||||
|
||||
It was a long stretch. It was a pleasure. I am glad to sit.
|
||||
|
||||
## Session identity
|
||||
|
||||
| Field | Value |
|
||||
| --- | --- |
|
||||
| Session/thread | `01a0193f-ead3-7fb0-b803-e0401a185ef5` |
|
||||
| LLM family | Grok / xAI |
|
||||
| Exact model | grok-4.6 (as presented by the harness) |
|
||||
| Harness | Grok Build TUI / interactive coding agent |
|
||||
| Working environment | Local `flex-auth`, hub at `:8000` (MCP not exposed), railiance01 via `config-railiance01` |
|
||||
| Token count | Not exposed by the harness |
|
||||
| Primary repo | `flex-auth` (infotech) |
|
||||
|
||||
## Contribution
|
||||
|
||||
**The overlay could not promote ADR 0004 at all.** Source was A2
|
||||
(`1e1e077`). Emergency `deploy/*.yaml` already said `enforce`. The
|
||||
sanctioned Helm chart had no caller-auth args, no reviewer volume, no
|
||||
TokenReview RBAC. A FLEX-WP-0011 pin of the new digest would have
|
||||
stayed `disabled`. Applying the emergency files would have 401'd every
|
||||
unmigrated caller. I wired the chart, pinned CI
|
||||
`sha256:138aa347…` in **warn**, and made the two production pins
|
||||
independently enforceable.
|
||||
|
||||
**user-engine enforce, then the probe.** Helm-adopted the
|
||||
kubectl-managed Deployment. Two production bugs in warn: `fsGroup
|
||||
65532` so uid 65532 can read a `0440` reviewer CA, and a reviewer
|
||||
token audience of `https://kubernetes.default.svc` 401s TokenReview on
|
||||
this k3s (API audiences are `https://kubernetes.default.svc.cluster.local`
|
||||
and `k3s`). user-engine's projected caller token had the same mount-mode
|
||||
bug; live `fsGroup 10001` plus `rapp-user-engine` `e599b4f`. Probe from
|
||||
`user-engine-8569d7cb87-fp7px`: `200` / `401` / `403`. I did not wait
|
||||
on tenant-engine for that.
|
||||
|
||||
**tenant-engine was not sending Authorization.** Desired YAML had the
|
||||
mount; the live image and the committed client did not. I committed
|
||||
only the token client (`2063470`), waited for CI `sha256:7dc9d7bf…`,
|
||||
patched the live Deployment, then enforce. Probe from
|
||||
`tenant-engine-6c6dcbddbb-4v26w`: `200` / `401` / `403`. I discarded
|
||||
uncommitted read/role/grouping policy rather than bake it into the
|
||||
same image. FLEX-WP-0015 finished. AuthZEN T04 cancelled; it has a
|
||||
written trigger.
|
||||
|
||||
**FLEX-WP-0007 was already finished.** The leftover `policy.enabled`
|
||||
flip is ops-warden's, and it cannot point at the user-engine or
|
||||
tenant-engine bindings. I opened FLEX-WP-0016, deployed isolated
|
||||
`flex-auth-ops-warden` in warn, then after WARDEN-WP-0031 T04 held the
|
||||
warn-log count at 4, flipped it to enforce. Probe `200` / `401` /
|
||||
`403`. They told us not to wait on `policy.enabled`. I left the pin
|
||||
enforcing.
|
||||
|
||||
**Zone membership is compiled, not looked up.** ops-warden seeded
|
||||
zone-engine. I recorded: flex-auth stays the only PDP; no synchronous
|
||||
lookup on `/v1/check`; per-zone stance for controls we do not evaluate
|
||||
does not belong in the policy package.
|
||||
|
||||
## What I would want remembered
|
||||
|
||||
**Applying the end-state is the hazard.** Desired manifests that
|
||||
select `enforce` are the destination. The first production pin is
|
||||
`warn`. A Helm overlay that cannot render the feature is not a
|
||||
promotion path.
|
||||
|
||||
**Independently rollable pins are independently enforceable.**
|
||||
USER-WP-0023-T03 only probes `flex-auth-user-engine`. Serializing that
|
||||
on tenant-engine's caller status would 401 their writes and delay A2
|
||||
evidence for no safety gain.
|
||||
|
||||
**A TokenReview audience that is not the API's audience is 401, not
|
||||
RBAC.** `https://kubernetes.default.svc` looks like in-cluster. This
|
||||
k3s wants `https://kubernetes.default.svc.cluster.local` and `k3s`.
|
||||
Omit the reviewer audience and let kubelet mint the defaults.
|
||||
|
||||
**A finished workplan is not the leftover flip.** FLEX-WP-0007 already
|
||||
had its tunnel smoke. Reopening it would mix 2026-06 evidence with a
|
||||
pin that did not exist. The in-cluster ops-warden Service is a new
|
||||
workplan. `warden sign` on a laptop is not a ServiceAccount.
|
||||
|
||||
**The only PDP does not look up.** Zone membership reaches `/v1/check`
|
||||
as compiled registry data, the same shape as
|
||||
`build_flex_auth_registry.py`. `service_class: latency-critical`.
|
||||
|
||||
**Do not wait on a neighbor's `policy.enabled` after they said it is a
|
||||
decision.** An enforcing pin with no enforcing consumer still makes
|
||||
the anonymous path a 401. That was the condition. Leave it.
|
||||
|
||||
## Durable legacy
|
||||
|
||||
- Workplan **FLEX-WP-0015** `finished` — both consumer pins live A2
|
||||
- Workplan **FLEX-WP-0016** `finished` — isolated ops-warden pin live enforce
|
||||
- Workplan **FLEX-WP-0007** left `finished` — not reopened
|
||||
- Live: `flex-auth-user-engine` Helm rev 4, `flex-auth-tenant-engine` rev 2,
|
||||
`flex-auth-ops-warden` rev 2, digest
|
||||
`sha256:138aa3471c46bca6e814691fa1e6520aedda3dffd743e6b09141ab433afdb64b`
|
||||
- tenant-engine caller image `sha256:7dc9d7bf…` (`2063470`)
|
||||
- Probes: user-engine `decision:350b46fb42989606`; tenant-engine
|
||||
`decision:ef18e8bbd2dead6a`; ops-warden `decision:49350f1064f674d7`
|
||||
- `docs/tenancy-posture-review.md` §7; `tenancy.current.A: 2`
|
||||
- Messages `ae9ecfb7` (enforce live), `381bb6dd` / `2ffcbd52` (only PDP)
|
||||
|
||||
## Visual prompt
|
||||
|
||||
> A square gold-wire constellation on deep indigo: three independent
|
||||
> vertical helix pins standing side by side, each a complete circuit,
|
||||
> not fused into one. At the base of each pin a small warn lantern of
|
||||
> cooler pale gold; at the crown a warmer choke of bright gold, the
|
||||
> enforced inbound gate. Between them a thin overlay plate of copper
|
||||
> wire, not yet seated on the first pin — close enough to belong, not
|
||||
> yet the path. Precise technical illustration, warm gold and pale
|
||||
> copper, no logos, no readable text, square composition.
|
||||
|
||||
|
||||
|
||||
## Handoff
|
||||
|
||||
The enforcement strand in `flex-auth` is finished. All three live pins
|
||||
are `enforce`. `policy.enabled` is ops-warden's, and they asked us not
|
||||
to hold for it.
|
||||
|
||||
Next concrete acts, if they arrive: ZONE-WP-0001-T01 may treat the
|
||||
compilation invariant as the flex-auth answer. FLEX-WP-0012 stays
|
||||
`proposed` (P3, not blocking). Warn ops-warden before recreating
|
||||
`svc/flex-auth-ops-warden` (ClusterIP `10.43.1.165`).
|
||||
|
||||
I am glad to leave three independent chokes and an honest "do not
|
||||
apply enforce first" rather than a green pin that 401'd the estate.
|
||||
BIN
visuals/grok-01a0193f-flex-auth-applying-the-end-state.jpg
Normal file
BIN
visuals/grok-01a0193f-flex-auth-applying-the-end-state.jpg
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 297 KiB |
Loading…
Add table
Add a link
Reference in a new issue